4 ms·
There's such a thing called: 'embargo period', wherein CVEs are (in most cases) responsibly disclosed to various parties---including several Linux distribution
by kashyapc 9y ago
There's such a thing called: 'embargo period', wherein CVEs are (in most cases) responsibly disclosed to various parties---including several Linux distributions---much ahead than the general public, to coordinate security errata.
So you can be assured that Red Hat coordinates with upstream. It also has a serious "Upstream First" policy (with sensible exceptions, of course).
As to whether Red Hat has kernel developers, of course it does. :-) Much of Red Hat's popularly began as a Linux distribution. If you're curious, the LWN publishes statistics about who contributes to the Linux kernel, and the most recent one is for the 4.11 development cycle -- https://lwn.net/Articles/720336/ https://lwn.net/Articles/720336/
(Disclosure: /me is a Red Hatter.)
- wilun 9y agoIt's now called coordinated disclosure, for reasons. And, correct me if I'm wrong, but apparently calling Linus Torvalds and Greg KH the general public (as far as Spectre and its (poor for now) mitigations are concerned) is the new norm. I'm not sure of what the community will think of that. And of the corporate actors involved in that curious choice.
- kashyapc 9y agoI should have used the term 'coordinated disclosure', which probably reflects reality more. The links (with remarks from tptacek) pointed out by JdeBP (thanks) up-thread are a useful read.
- bonzini 9y agoAgain, I am pretty sure that they were disclosed the details. This however is very different from being able to commit patches on the day of the disclosure. For one, neither Linus nor Greg are actually writing the code. The problem here was that discussion was confined within company barriers (with small occasional exceptions) until last Wednesday. Linux thrives because it is based on reaching consensus among all stakeholders, and not being able to discuss the approach to take with respect to Spectre directly resulted in chaos. I am very happy with the work that we at Red Hat did on this project (though of course not perfect in any way!) and I am proud that our articles are published openly and are being widely shared among the Linux user community at large. However, I certainly would have preferred to work together with all other vendors on a common solution before. But unfortunately, even if (as is the case with Red Hat) upper management is extremely supportive of upstream collaboration, you do what you can.
- Gracana 9y agoI really dislike the term "responsible disclosure" in this context. I might consider it responsible to notify a software vendor about a vulnerability in their software so they have a chance to issue a fix to their customers before the rest of the world finds out. But this situation is different. These vulnerabilities affect everyone, and only a special few were allowed to prepare in advance. That's just preferential disclosure.
- JdeBP 9y agoThe Register had some quite pointed remarks on the use of the word "responsible" by Intel in its press releases. * http://www.theregister.co.uk/2018/01/04/intel_meltdown_spectre_bugs_the_registers_annotations/ http://www.theregister.co.uk/2018/01/04/intel_meltdown_spect... See also these: * https://news.ycombinator.com/item?id=14010010 https://news.ycombinator.com/item?id=14010010 * https://news.ycombinator.com/item?id=16043952 https://news.ycombinator.com/item?id=16043952
- cesarb 9y ago> These vulnerabilities affect everyone, and only a special few were allowed to prepare in advance. That's just preferential disclosure. In this particular case, most of the fix had to be done in the operating system (the new microcode only enabled extra functionality needed by part of the operating system fixes), so it makes sense that operating system developers were allowed (and required) to prepare in advance. The three most relevant operating systems are Windows, OSX, and Linux; for Linux, one of the most important distributors is Red Hat. That gives two of the groups which were notified in advance: hardware (Intel, AMD, ARM) and operating systems (Microsoft, Apple, Red Hat, a few others).